Subz HQ — Privacy Policy

This Policy applies to:

• Adult users (club staff, players, parents/guardians, and other members)
• Parent or guardian accounts that manage linked children’s accounts within Subz HQ
• Visitors to our website

Where a parent or guardian creates or manages a child account, they are responsible for providing information about that child and for confirming they have authority to do so.

Depending on how the Service is used:

• Your club typically decides what club operations data to collect and how to use it for squad management (for example forms, medical notes, fines, shop orders, lineups, and event details). In those cases, your club may act as a controller of that information.
• Subz HQ provides the platform, hosting, and related infrastructure. For club-held operational data we may act as a processor (or equivalent) on the club’s instructions.
• Subz HQ is the controller for platform account data we decide to process ourselves (for example authentication, account security, support, and Service improvement).

Club staff with appropriate roles or permissions may see information needed to run the club (for example names, roles, RSVPs, messages, payments status, forms, and — where provided and permitted — medical notes).

Depending how you use Subz HQ, we may collect the following.

Account and authentication information

• Email address
• Password (handled securely by our authentication provider; we do not store passwords in plain text)
• Unique user ID
• Account type (for example, standard account or managed child account)
• Email confirmation and password-reset related authentication data

Profile information

• First name and last name
• Country
• Town or city
• Year of birth
• Date of birth (where provided, including for some managed child accounts)
• Profile photo / avatar (if provided)
• Profile preferences
• Current team membership and role (for example owner, admin, coach, manager, or member)

Children and guardian information

Where parents/guardians use linked-child features, we may collect:

• Child’s name
• Gender (if provided)
• Date of birth and/or age-band / FA age-group information used for club administration
• Medical notes (if provided by a parent/guardian or authorised user)
• Avatar / photo (if provided)
• Relationship between guardian and child
• Records of guardianship / linking

Managed child accounts are created for club use and are typically controlled by a linked parent or guardian rather than used as independent login accounts.

Teams, clubs, and membership information

• Teams and clubs you create or join
• Membership roles and permissions
• Join requests and membership status
• Squad and lineup information (for example position, shirt number, captain designation)
• Availability / RSVP responses and related notes

Messages and communications

• Messages sent in team or group chats
• Photos or images shared in chat
• Mentions, reactions, polls, and read/mute settings where used
• In-app notifications
• Customer support messages you send us (including any screenshots or contact details you include)

Club content and activity

• Club news posts, likes, comments, and related engagement
• Club forms and answers you submit (including photos where a form requests them)
• Files uploaded to member/club records (for example PDFs or photos)
• Schedule and event details (including event titles, times, and free-text venue/address information)
• Match-related information entered in the Service (for example scores or stats where used)

We do not collect continuous GPS/device location. Event venues are free-text addresses that may be opened in a maps app on your device.

Shop and ordering information

• Product enquiries and orders
• Order options, quantities, notes, and status
• Collection preferences / slots where used
• Wishlist / restock preferences where used
• Related order messages between members and staff

Payment information

Payments are processed by Stripe. Clubs collect card payments via Stripe Connect; Subz HQ is not the merchant of record for club fees, fines, or shop orders.

• We may process payment-related records such as charges, fines, season fees, payment status, and payout/onboarding status for clubs
• We do not collect or store full debit/credit card numbers
• Card details are handled by Stripe under Stripe’s own privacy terms

Notifications

• Push notification tokens
• Notification preferences
• Whether notifications are enabled or disabled

You can usually manage notifications in the app and/or your device settings.

Device and technical information

• Device type and operating system
• App version
• IP address
• Device identifiers used for app operation (for example push delivery)
• Crash / diagnostic information where available through our hosting or platform tools
• Basic usage information needed to operate the Service (for example login activity, features used, and session activity)

Local device storage

The app may store limited information on your device (for example preferences, cart state, or last-seen chat markers) to improve performance and usability.

Advertising / sponsorship enquiries

The Service may include a sponsorship / advertising enquiry option that opens your email app so you can contact us. We do not currently use third-party advertising networks or ad-tracking SDKs in the app.

We use personal information to:

• Create and manage accounts
• Authenticate users securely
• Provide club, team, squad, schedule, messaging, shop, forms, and news features
• Allow parents/guardians to manage linked children where authorised
• Process payments and related club financial workflows
• Send service notifications and reminders
• Respond to support requests
• Maintain security, prevent abuse, and protect the Service
• Improve reliability and user experience
• Comply with legal obligations

Where your club acts as controller, it uses relevant information to run club activities (for example training, fixtures, membership, forms, and payments). Authorised club/team staff may also export membership lists, attendance/availability history, payment statements, form responses, and similar club-operations records for legitimate club purposes (for example coaching, safeguarding follow-up, or financial administration). Clubs should only share those exports with people who are authorised to receive them.

Where UK GDPR / EU GDPR applies, we process personal information under one or more of these bases:

• Contract — to provide the Service you requested
• Consent — for example certain optional data, notifications, or marketing where consent is required
• Legitimate interests — for example improving the Service, securing accounts, and preventing misuse (balanced against your rights)
• Legal obligation — where we must keep or disclose information by law

Special category (health) data

Medical notes and any other health-related information (including health details submitted in forms) are special category data. We process this only where an Article 9 condition applies — typically explicit consent given by a parent/guardian or authorised adult, or another applicable condition (for example where necessary to protect vital interests in limited circumstances).

You may withdraw consent for optional medical notes where processing is based on consent (this does not affect processing already lawfully carried out). Clubs should only request medical information that is necessary for participation and safeguarding.

Where we rely on consent for other optional processing, you may withdraw it at any time (this does not affect processing already carried out).

We do not sell your personal information.

We may share information with:

• Other users in your club/team as needed for the Service (for example names, roles, messages, RSVPs, attendance/availability, shop order details visible to relevant staff, exported club-operations spreadsheets/statements where staff use export tools, and content you post). Medical notes, where provided, are intended for authorised guardians and relevant club staff only, subject to access controls in the Service.
• Service providers that help us operate Subz HQ, including: Supabase — authentication, database, file storage, and backend hosting; Stripe — payments and related payout/onboarding flows; Expo — mobile app delivery and push notification infrastructure; other email / communications tools where used for support or service emails; optional operational helpers such as UK postcode lookup (for example postcodes.io) and invite QR image generation (which may include an invite code in a request URL)
• Professional advisers or authorities where required by law, to protect rights and safety, or to investigate fraud/abuse

Some features may open third-party apps on your device (for example Maps, WhatsApp, or your email app). Those apps are governed by their own privacy policies. Please avoid sharing medical or other sensitive information via third-party share flows unless necessary.

Your information may be processed or stored outside your country of residence by us or our service providers. Where required, we use appropriate safeguards for such transfers (for example standard contractual clauses or equivalent mechanisms offered by our providers).

We keep personal information only as long as reasonably necessary to:

• provide the Service
• maintain your account
• meet legal, accounting, or reporting requirements
• resolve disputes and enforce agreements

Typical categories include:

• Account and profile data — while your account is active, then deleted or anonymised after account deletion (subject to legal holds)
• Club operational data (messages, forms, events, lineups, news) — while needed for club operations and account history; clubs may also have their own retention needs
• Payment and financial records — retained as needed for accounting, tax, chargebacks, and legal obligations (often for several years)
• Support correspondence — for as long as needed to resolve issues and maintain service quality

A more detailed retention schedule is available on request from support@subzhq.com.

If you delete your account, we delete or anonymise personal information associated with it, except where we must retain certain records (for example payment or legal records).

You can request account deletion in the app:

• Open Profile and choose Delete Account

Account deletion may be restricted if you are the owner/manager of a team that still has other members. In that case you may need to transfer ownership or remove other members first.

When an eligible account is deleted:

• your account access ends
• eligible personal data is deleted or anonymised
• teams you solely own with no remaining members may also be removed
• managed child accounts for which you are the sole guardian may be removed; if another guardian remains, the child may be unlinked rather than deleted

Depending on your location, you may have rights to:

• access your personal information
• correct inaccurate information
• delete personal information
• restrict or object to certain processing
• withdraw consent where processing is based on consent
• request a portable copy of your data

To exercise these rights, contact us using the details below. We may need to verify your identity before responding. Some requests (including data export) may be handled via support rather than fully automated in-app tools.

If your request relates to club-controlled data, we may need to involve your club or direct you to them.

Subz HQ includes features for sports clubs that may involve information about children, typically provided and managed by a parent, guardian, or authorised club staff.

• The Service is not intended for independent use by children under 16 without appropriate parental/guardian involvement where required by law
• Parents/guardians should only submit children’s information they are authorised to provide
• Medical or other sensitive child information should only be submitted where necessary and with appropriate authority/consent
• If we learn we have collected children’s information inappropriately, we will take reasonable steps to delete it

Our website may use cookies or similar technologies to:

• operate and secure the site
• remember preferences
• understand basic site usage

You can control cookies through your browser settings. The mobile app may use local storage and similar device technologies as described above.

The Service relies on third-party providers (including Supabase, Stripe, and Expo). Those providers process information under their own privacy policies. We encourage you to review them.

Subz HQ is not responsible for the privacy practices of third-party websites or apps you open from the Service.

We use appropriate technical and organisational measures to protect personal information, including access controls, encryption in transit where applicable, and restricted access to sensitive content. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date and may provide notice in the Service where appropriate.

Where required by law, we will seek fresh consent for material changes that rely on consent.

If you have questions about this Privacy Policy or your personal information:

Subz HQ

• Email: support@subzhq.com
• Website: https://www.subzhq.com/